flow-next-opencode-sync
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled binary
flowctllocated in the.opencode/bin/directory. This is used to query task information and update specifications. - Evidence: The script explicitly defines
FLOWCTL="$OPENCODE_DIR/bin/flowctl"and uses it forconfig get,show, andtaskscommands. - [COMMAND_EXECUTION]: Shell utilities like
git,jq, andsedare used for environment validation and argument parsing. - Evidence: Uses
git rev-parse --show-toplevelto find the project root andjqto parse JSON output from the local tool. - [SAFE]: The skill implements input validation for the
$ARGUMENTSvariable, checking that the provided ID follows the expectedfn-format before processing, which mitigates simple command injection risks.
Audit Metadata